Examkin

Question

Difficulty: MediumTroubleshooting DNS and Name Resolution Services

A network administrator is investigating a name resolution failure on a corporate workstation. Standard DNS queries for small host records complete successfully, but queries returning large responses (such as DNSSEC queries) time out, as shown in the following CLI output:

$ dig +dnssec internal.example.com
;; Truncated, retrying in TCP mode.
;; communications error to 10.0.0.1#53: connection timed out
;; communications error to 10.0.0.1#53: connection timed out
;; no servers could be reached

Which of the following network misconfigurations is the most likely root cause of this failure?

  1. An Access Control List (ACL) on a perimeter firewall is blocking outbound TCP traffic on port 53.Answer
  2. B
    The perimeter firewall is blocking UDP port 53, preventing DNSSEC from completing its connection-oriented three-way handshake.
  3. C
    The authoritative DNS server is missing an MX record required to complete the DNSSEC key exchange validation.
  4. D
    The resolver is misconfigured to route all DNSSEC queries over HTTP port 80 instead of standard DNS port 53.

Answer

An Access Control List (ACL) on a perimeter firewall is blocking outbound TCP traffic on port 53.
DNS uses UDP port 53 for standard name queries. However, when responses are too large to fit in standard UDP packets—which commonly occurs with DNSSEC records or zone transfers—the DNS server sets the Truncated (`TC`) flag. The client resolver then initiates a TCP connection over port 53 to retrieve the complete data. Blocking TCP port 53 on a firewall allows basic host lookups to function normally but causes truncated and DNSSEC queries to time out.

Step-by-Step Solution

1
Analyze the CLI output snippet provided in the command line prompt.
The tool successfully issues a UDP query, receives a truncation flag (`TC` bit set), and attempts to retry the query using TCP mode.
DNS uses UDP port 53 by default for small messages (typically under 512 bytes). When responses exceed buffer limits (common with DNSSEC keys and signatures), the DNS protocol specifies falling back to TCP port 53.
2
Evaluate the failure symptom upon retrying in TCP mode.
The command reports `communications error ... connection timed out` when attempting TCP resolution.
Timeouts specifically during the TCP retry phase indicate that UDP port 53 traffic is permitted, but TCP port 53 traffic is filtered or blocked by an intermediate firewall or Access Control List.
3
Select the root cause matching the diagnostic evidence.
Identify that an ACL blocking TCP port 53 causes truncated/DNSSEC queries to fail while standard UDP queries succeed.
Firewalls must allow both UDP and TCP port 53 for complete DNS functionality.

Key Concept

DNS TCP Port 53 Transport Fallback for Truncated and DNSSEC Payload Responses
Rate this question

Topics

Troubleshooting DNS and Name Resolution Services

More questions from this topic